From a2df088173e8147608b564cfae49c1a5dc7d2e38 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Thu, 16 Jul 2026 16:42:40 -0400
Subject: [PATCH 1/3] fix(ci): fix Splunk integration test flakiness and
 re-enable

---
 .github/workflows/integration.yml            | 5 ++---
 src/sinks/splunk_hec/common/util.rs          | 2 +-
 tests/integration/splunk/config/compose.yaml | 8 +++++++-
 3 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index ae305e0245a0e..e853113b2525c 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -96,8 +96,6 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        # TODO: Add "splunk" back once https://github.com/vectordotdev/vector/issues/23474 is fixed.
-        # If you modify this list, please also update the `int_tests` job in changes.yml.
         service:
           [
             "amqp",
@@ -124,8 +122,8 @@ jobs:
             "kafka",
             "logstash",
             "loki",
-            "mqtt",
             "mongodb",
+            "mqtt",
             "nats",
             "nginx",
             "opentelemetry",
@@ -133,6 +131,7 @@ jobs:
             "prometheus",
             "pulsar",
             "redis",
+            "splunk",
             "webhdfs"
           ]
     timeout-minutes: 90
diff --git a/src/sinks/splunk_hec/common/util.rs b/src/sinks/splunk_hec/common/util.rs
index 6b4015e7a415e..1be21d1f60bdd 100644
--- a/src/sinks/splunk_hec/common/util.rs
+++ b/src/sinks/splunk_hec/common/util.rs
@@ -495,7 +495,7 @@ pub mod integration_test_helpers {
                     .send()
             },
             Duration::from_millis(500),
-            Duration::from_secs(30),
+            Duration::from_secs(60),
         )
         .await;
 
diff --git a/tests/integration/splunk/config/compose.yaml b/tests/integration/splunk/config/compose.yaml
index 4cff3cab1ca0d..4bc32d573ed0c 100644
--- a/tests/integration/splunk/config/compose.yaml
+++ b/tests/integration/splunk/config/compose.yaml
@@ -8,11 +8,17 @@ services:
       - SPLUNK_PASSWORD=password
       - SPLUNK_HEC_TOKEN=abcd1234
     volumes:
-      - ../data/splunk/default.yml:/tmp/defaults/default.yml
+      - ../data/default.yml:/tmp/defaults/default.yml
     ports:
       - 8000:8000
       - 8088:8088
       - 8089:8089
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8088/services/collector/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 30
+      start_period: 60s
 
 networks:
   default:

From 9fd59cf9e870beea93c19e23598d8cb61e209aa5 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 20 Jul 2026 11:34:46 -0400
Subject: [PATCH 2/3] fix(ci): add splunk to integration review trigger matrix

---
 .github/workflows/ci-integration-review.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/ci-integration-review.yml b/.github/workflows/ci-integration-review.yml
index 62d2438d3c66b..b30df2c22261d 100644
--- a/.github/workflows/ci-integration-review.yml
+++ b/.github/workflows/ci-integration-review.yml
@@ -139,6 +139,7 @@ jobs:
             "prometheus",
             "pulsar",
             "redis",
+            "splunk",
             "webhdfs"
           ]
     steps:

From 56d2f9c4f77a27cf8449802daf5c1ea3117c9b61 Mon Sep 17 00:00:00 2001
From: Thomas <thomas.schneider@datadoghq.com>
Date: Mon, 20 Jul 2026 12:53:49 -0400
Subject: [PATCH 3/3] fix(splunk hec sink): pin non-ack token for
 disabled_on_server ack test

---
 src/sinks/splunk_hec/logs/integration_tests.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/src/sinks/splunk_hec/logs/integration_tests.rs b/src/sinks/splunk_hec/logs/integration_tests.rs
index 76aa7f4bdf8aa..475ee1c49460e 100644
--- a/src/sinks/splunk_hec/logs/integration_tests.rs
+++ b/src/sinks/splunk_hec/logs/integration_tests.rs
@@ -41,6 +41,9 @@ use crate::{
 const USERNAME: &str = "admin";
 const PASSWORD: &str = "password";
 const ACK_TOKEN: &str = "ack-token";
+// Matches `SPLUNK_HEC_TOKEN` in tests/integration/splunk/config/compose.yaml, which is not
+// configured for indexer acknowledgements (unlike `ACK_TOKEN`).
+const DEFAULT_TOKEN: &str = "abcd1234";
 
 async fn recent_entries(index: Option<&str>) -> Vec<JsonValue> {
     let client = reqwest::Client::builder()
@@ -462,7 +465,12 @@ async fn splunk_indexer_acknowledgements() {
 async fn splunk_indexer_acknowledgements_disabled_on_server() {
     let cx = SinkContext::default();
 
-    let config = config(JsonSerializerConfig::default().into(), vec!["asdf".into()]).await;
+    // `config()` fetches whatever token Splunk's inputs API happens to list first, which can
+    // be `ACK_TOKEN` and would defeat the point of this test. Force the non-ack token instead.
+    let config = HecLogsSinkConfig {
+        default_token: String::from(DEFAULT_TOKEN).into(),
+        ..config(JsonSerializerConfig::default().into(), vec!["asdf".into()]).await
+    };
     let (sink, _) = config.build(cx).await.unwrap();
 
     let (tx, mut rx) = BatchNotifier::new_with_receiver();